abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d

Analysis

max time kernel
81s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 12:51

Target

abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d.exe
Size

58KB
MD5

13fbf214904fddb6b0fbd7d0671f2be1
SHA1

1f47c2a0a94be693cc10dc91332e86e5fb7ff50a
SHA256

abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d
SHA512

50df043ada24f10c4b3c4a3ca7f43d1009d5782d489e7db8874e5781d1c7760ab6f3d46aec1321fb1d187649be1b40b235d39fc63ef1304605ef40a4abda3b17
SSDEEP

768:LP+PmWr1G79j19bj3pJoL4rlAlCNo25g0r7dzG4AO2O4SxCibnzMXDNhTUEjIy/R:LP+4d19bQqlBnlG4wQCYz+D/TUA9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	592	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 268	592	abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d.exe	28
PID 592 wrote to memory of 268	592	abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d.exe	28
PID 592 wrote to memory of 268	592	abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d.exe	28
PID 592 wrote to memory of 268	592	abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d.exe	28

C:\Users\Admin\AppData\Local\Temp\abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d.exe
"C:\Users\Admin\AppData\Local\Temp\abdeda3fc0e5e1233090ec527c536d48a9413eb9885bc0a80461c22e34658c2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 120
  2⤵
  - Program crash
  PID:268